MassOrBye — Not what you want. What you need.

LEGAL

Privacy Policy

Effective date: November 30, 2026

This policy takes effect November 30, 2026. Current policy is available here: https://massorbye.com/privacy.html.

Preliminary notice – Minimum Age

MassOrBye STUDIOS services are intended exclusively for users aged 16 or over. Users under 16 may not register or use the application. This requirement will apply to existing accounts in accordance with the notification arrangements set out in the MassOrBye Terms and Conditions.

MassOrBye STUDIOS reserves the right to suspend or delete any account where it has reasonable grounds to believe that the user is below the minimum age set out in the MassOrBye Terms and Conditions.

If you are the parent or legal guardian of a child under 16 who has created an account with MassOrBye STUDIOS, please contact us at contact@massorbye.com so that the account and associated data can be deleted.

1. General information

At MassOrBye, your privacy matters to us. We collect personal data to provide your account, to track your workouts, support the features you choose and keep the platform secure. We also use data for usage statistics and to measure campaigns promoting MassOrBye, as explained in this Policy. You control optional connections and sharing, and we ask for consent where required, including explicit consent for health-data uses. We do not sell your personal data and do not display third-party advertising in MassOrBye.

This Policy explains how MassOrBye STUDIOS, S.L. (“MassOrBye STUDIOS”) collects, uses, discloses and protects personal data in its application, website and related services. It describes account, training, social connection, support, security, measurement and integration features, and the choices and rights available to you. Regulation (EU) 2016/679 (“GDPR”) and the applicable data protection legislation apply. This information is supplemented by the notices and choices presented when you use a particular feature.

2. Data controller

The controller of the personal data you provide or that we obtain through other means is MassOrBye STUDIOS. You can contact the controller at contact@massorbye.com.

MassOrBye STUDIOS has appointed a Data Protection Officer, who can be contacted at contact@massorbye.com.

3. Personal data and processing

This Privacy Policy applies to users, customers, prospective customers and job applicants who interact with MassOrBye STUDIOS. It also applies to people whose contact details we receive when a user synchronises their address book, even if they do not have a MassOrBye account.

MassOrBye STUDIOS processes personal data for the following purposes:

Service security and operational integrity: ensuring the security, availability, stability and proper operation of our services; preventing abuse and reviewing content, reports and breaches of the rules of use to apply the measures provided for in the Terms and Conditions.

Handling requests and communications: responding to enquiries, information requests or complaints made through contact forms or other communication channels, including the AI-assisted support described in this Policy and management of the press centre.

Participation in interactive environments: enabling profiles, workouts, comments and other content to be shared with the audience you select; providing social connection features; and displaying eligible gym-tagged workouts and associated participation on gym profiles and leaderboards, subject to the information and choices explained in section 9.

User registration and account management: managing the creation of accounts in our applications or platforms, including account features, preferences, support requests and technical assistance.

Recruitment and applicant management: processing information submitted in job applications, assessing applicants and managing recruitment or selection processes.

Marketing and promotional communications: sending promotional messages, newsletters and announcements under the permissions and conditions described in this Policy. Campaign attribution and measurement are described separately below.

Provision and maintenance of contracted services: providing updates, notifications and communications necessary to administer services subscribed to or purchased by the user.

Usage statistics and campaign measurement: understanding how the service is used, producing usage statistics and measuring the effectiveness of campaigns promoting MassOrBye, including relevant installations and conversions. Optional analytics and campaign measurement are subject to the conditions in sections 3.3 and 6.1. Technical processing necessary to operate or secure the service is limited to those operational purposes.

Personalised training and coaching: using the workout and physical information you provide or choose to connect to deliver requested training features and track your progress. Where you use assisted training, this may include injury information you choose to provide to adapt your training plan. If you connect to a coach or coaching organisation, we make the authorised training information available for the coaching service you request. Health-data processing and coaching access are subject to the separate conditions in this Policy.

Strength benchmarks and aggregated insights: using relevant workout and performance records, including estimated one-repetition maximum (1RM), to calculate strength indicators and create aggregated benchmarks for features such as Strength Levels. Individual records remain personal data while linked or reasonably linkable to an account. Benchmarks made available to other users do not disclose identifiable individual records. We may use truly anonymised and aggregated statistics to develop, improve and provide training-related features, including paid features or modules, provided that individuals cannot reasonably be identified. This does not authorise selling or licensing personal records to third parties.

Geolocation: using location authorised by the user to display nearby gyms and, depending on the feature used, approximate location derived from connection data to suggest nearby users and manage territorial availability of certain features, under the legal bases and conditions in this Policy.

Partner membership programmes: verifying and managing access obtained through a membership or benefits partner, linking the relevant membership to your MassOrBye account and exchanging limited information necessary to calculate and reconcile programme charges.

Recommendation features may use automated processes and, where relevant, manual selection to suggest workouts or users to connect with, based on activity, profile information, language, the presence of a profile picture or location data described for each purpose. The information used depends on the active feature and applicable choices. These recommendations do not themselves determine account suspension or subscription rights.

MassOrBye STUDIOS processes personal data on the following legal bases, according to the purpose concerned:

Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR): creating and administering your account; recording and consulting ordinary workout data necessary for the requested service; managing selected interactive features, purchases, subscriptions and related support; sending essential service communications and verifying a number by SMS when you request it for an account feature. This also applies to pre-contractual steps in recruitment, operations necessary to provide membership access you request and administering a coaching connection you choose. Health data and optional features requiring permission remain subject to the specific conditions below.

We obtain your prior explicit consent to process health data for the relevant purpose under Articles 6(1)(a) and 9(2)(a) GDPR. This includes collecting and using health data for requested training features and any authorised publication or disclosure to a coach or external service. Permission for one purpose does not automatically cover another. You may withdraw each consent at any time, as easily as it was given. Accepting the Terms and Conditions or this Policy, accepting a medical disclaimer, having a public profile or granting a technical device permission does not, by itself, provide these authorisations. A new purpose or access outside an existing permission requires the additional consent applicable to that use.

Compliance with legal obligations (Article 6(1)(c) GDPR): processing necessary to comply with applicable legislation and regulations. This basis applies to processing required by specific laws, including legal security obligations and handling data protection rights, where applicable.

Legitimate interests (Article 6(1)(f) GDPR): MassOrBye STUDIOS may process data necessary to handle general enquiries and protect service security and integrity where processing is not required by law or for contract performance. These interests are balanced against users’ rights and freedoms, particularly for minors. This basis does not replace consent required for cookies, similar technologies or marketing communications. We may also process approximate location derived from an IP address to suggest connections with nearby users and manage territorial restrictions on contact synchronisation. Our interests are enabling social connections within MassOrBye and administering this feature’s availability by country. You may object by contacting contact@massorbye.com, subject to the conditions applicable to the right to object. Abuse prevention and report reviews rely on our interest in protecting users and the service, except where processing is required by a specific law. For necessary, proportionate programme billing reports that are not objectively required to perform our contract with you, our legitimate interest is calculating and reconciling the charges payable for the membership service. We limit the information reported and balance this interest against your rights. You may object as explained in section 13. This basis does not replace any condition required for health-data processing.

Consent (Article 6(1)(a) GDPR): for marketing communications where required; retaining applications for future recruitment; usage, performance or campaign measurement requiring consent, including non-exempt cookies and similar technologies; optional personalisation, gym location and integration features; voluntary address book synchronisation and permission for others to discover your account. Synchronisation and discovery are independent choices. The scope of discovery permission, the identifiers used and the available controls are explained in section 8.2.

Other people’s contact details (Article 6(1)(f) GDPR): to compare identifiers from a synchronised address book with accounts that have permitted discovery, our legitimate interest is enabling connections requested by users within MassOrBye. Processing is limited to necessary identifiers and comparison operations, with proportionate retention. The uploader’s permission is not consent from the people listed. Section 8.4 explains their rights, including objection and deletion without registering, and how we provide information about this processing.

Strength Levels and aggregated insights: calculating strength indicators objectively necessary for a feature you request relies on contract performance for ordinary workout data. We obtain separate consent before reusing identifiable or linkable records to create benchmarks for other users or develop features; where those records reveal health information, that consent is explicit. Anonymisation itself must start from lawful processing. Truly anonymous results fall outside personal-data rules only while individuals cannot reasonably be identified.

Depending on the features used, we process identification, contact and login data; profile and preference data; workout and activity records, content and indicators; enquiries, applications, tickets and attachments; technical information and account, device or installation identifiers; interactions and campaign data; phone numbers and verification records; address book phone numbers and email addresses for social connection features; location; reports; and limited purchase and subscription data. Depending on the feature, these categories also include progress photos, injury information, gym tags and partner membership identifiers and eligibility information. Training and health information may be shared with a coach only within the scope explained and authorised before connection.

If you register through a supported third-party sign-in service, we receive the registration information that service provides under the applicable permissions. The service is identified when you choose that sign-in option.

Heart rate and injury information are health data. Physical measurements, progress photos and exercise records may also reveal health information depending on their content, combination and use. MassOrBye may receive health and physical activity data that you enter or choose to connect from compatible devices, equipment, applications or health platforms. We process health data for the specific purposes covered by your explicit consent, subject to any limited independent legal condition described in this Policy. Connecting a device or providing information for training does not itself authorise publication or disclosure to a coach or external AI service.

Health and physical activity data include workout records, exercise routines, sets, repetitions and weights, and performance indicators derived from the user’s activity history.

Body data provided voluntarily: you may choose to enter height, weight and other body measurements. These fields are entirely optional and do not affect access to the application’s core features.

4. Collection of personal data

MassOrBye STUDIOS processes your personal data lawfully, fairly and transparently and limits processing to the purposes for which they were collected.

Personal data collected from individuals are included in the processing activities for which MassOrBye STUDIOS is responsible and in its Record of Processing Activities.

MassOrBye STUDIOS does not access or store the full card or bank account details used to pay for subscriptions, which are managed by the relevant billing provider. We may receive purchase and subscription status information and, depending on the purchase channel, the last four card digits to identify the transaction, manage service access and handle related enquiries.

You may create an account in our services. Registration requires personal data. At registration, you are informed of the data required and the legal basis for processing, as detailed in MassOrBye’s Terms and Conditions and this Policy. Mandatory fields are identified; without necessary data, registration or the requested feature cannot be provided. Optional data is distinguished from mandatory data.

5. Automation and user support

We use specialist technology providers for user support, request management and internal collaboration tools, as well as AI assistance services, to handle enquiries. These tools process enquiry content, attachments and associated account or device data necessary to handle the request. Health data accessible to AI assistance are those you include in the enquiry or its attachments and may only be used under the permissions explained below to analyse the issue and respond. Please provide only information necessary for your request.

The agent may prepare response suggestions for team review and, in certain cases, send responses automatically. Our team may modify suggestions or respond manually, and you may request human review of your enquiry. This use is separate from voluntarily connecting your account to an AI service to ask about workouts. Support relating to contracted services relies on contract performance; general enquiries may be handled on the basis of our legitimate interest in responding.

Where resolving an enquiry requires health data, we will first request your explicit consent for that purpose (Articles 6(1)(a) and 9(2)(a) GDPR). AI use of these data requires permission expressly covering that assistance and processing by the AI providers involved, identified in the information provided before you authorise that use. Merely sending an enquiry or attachment does not itself provide this permission. Without it, health data will not be used in AI-assisted support.

You may request support from our team without AI assistance and withdraw either permission by contacting contact@massorbye.com. Refusing AI assistance does not prevent you from receiving team support. If you do not permit health data processing to resolve the enquiry, we will assist using information that can be processed without those data. Withdrawal stops the authorised use; subsequent retention is limited to the circumstances and conditions in the retention section.

6. Recipients and international transfers

We use specialist providers to deliver and administer our services. Depending on the feature, they may receive account and contact data, content and files, enquiry information, technical data and identifiers, interactions and campaign data, verification information, location or limited purchase and subscription data. Each disclosure is limited to what is necessary for its purpose and subject to the relevant legal basis and safeguards.

Provider categories include technology service companies specialising in hosting and infrastructure; account management and authentication; analytics and campaign and affiliate attribution; electronic messaging, notification delivery and contact method verification; user support, enquiry management and AI assistance; internal collaboration; security and abuse prevention; maps, gym searches and location estimation; and purchase and subscription management. They may provide services from the European Economic Area or third countries, including the United States, with the safeguards described in the international transfers section. Providers processing data under our instructions act as processors or subprocessors. Other services may act as controllers for their own purposes, depending on the service and applicable conditions. You may request information about specific recipients and their locations at contact@massorbye.com.

Other MassOrBye users may receive information when you choose to publish content or allow account discovery, as explained in the contacts and visibility sections. If you connect an external service or share content with it, that service receives the data covered by the connection or sharing option. A public account does not itself authorise health data disclosure or account discovery.

When you connect your account to a coach or coaching organisation, the authorised training information is made available to the recipient identified before connection, as explained in section 7.6. This access is separate from the public visibility of your profile and workouts.

We use analytics providers to process usage interactions, technical information and identifiers for the measurement purposes described in this Policy. Campaign measurement providers may process device or installation identifiers, IP addresses, device characteristics and app or subscription events, including events sent from our servers, to attribute installations and measure campaigns promoting MassOrBye. Some measurement methods provide aggregate reports without individual device identifiers; this does not mean that all processing by a provider is anonymous.

Where consent is required for analytics or campaign measurement, including non-exempt storage of or access to information on your device, we request it before starting that activity. An information notice, acceptance of this Policy or continued use of MassOrBye does not replace that consent. Any processing permitted without consent must meet the applicable exemption, where relevant, and have its own lawful basis and limited purpose.

You can disable optional usage analytics through the in-app privacy control. This stops further collection and transmission for that analytics purpose, including equivalent events sent from our servers. We do not continue those analytics under a replacement username or persistent pseudonymous identifier after you disable it. Campaign-measurement choices apply to their corresponding processing. Necessary service and security operations are distinguished from optional measurement. Refusing optional measurement does not prevent use of features that do not require it. Section 11 explains how previously collected data is handled.

For authentication, notification delivery, gym searches and display, and abuse prevention, we use providers specialising in identity management, notifications, maps and security. Depending on the feature, these may involve login data, installation and notification identifiers, searches, requested location or technical information necessary to verify requests.

We use electronic messaging and verification providers to send service communications and notifications and verify contact methods associated with the feature you request. For SMS verification, these providers process phone numbers and sending, delivery and attempt records necessary to send and verify codes and prevent abuse.

MassOrBye STUDIOS may disclose personal data to law enforcement, public authorities or courts where required by law or a valid order, or where another legal basis permits a necessary disclosure to protect people’s rights or vital interests. Disclosure is limited to data relevant to that purpose.

If you access MassOrBye through a membership or benefits partner, we receive your membership identifier and email address to verify eligibility and link your membership to your MassOrBye account. We share member or account identifiers and limited usage events, including the relevant activity type, date and time and logged workout duration, to calculate and reconcile programme charges. The partner can associate these events with your membership. These billing reports do not include workout content, heart-rate readings or injury information, and MassOrBye does not send them directly to your employer. The partner and its applicable privacy information are identified when you activate access. Retention of membership information is distinguished from transmission of usage events in section 11.

Service provision and integrations may involve transfers or access from countries outside the European Economic Area, including the United States. In addition to a legal basis for processing, these operations require a valid mechanism under Articles 44 onwards GDPR. Consent to connect an account does not replace required transfer safeguards.

For international transfers, we use a European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses, supplemented where necessary by additional measures. The EU–US Data Privacy Framework is used only for entities with a current certification covering the processing concerned. You may request information about destinations, recipient entities and the mechanism applicable to each transfer, including a copy of the safeguards, at contact@massorbye.com.

7. Third-party integrations

You may choose to connect MassOrBye to a compatible external AI service for workout and routine features. Before activation, we identify the service and explain the data it can access, the purpose and the scope of historical or ongoing access. The service may request permitted data through the MassOrBye API to answer your questions or provide training recommendations and, where supported and authorised, create or save training plans. Simply using MassOrBye does not enable this connection. Sharing a single workout with another application is separate from granting access to your account history.

Authorised access may cover existing and future workouts, including exercises, dates, sets, repetitions, loads, distance and duration, within the scope explained before connection. Access to your history does not mean that the entire history is transferred with every query. Health data, including recorded heart rate, are accessible only where prior explicit consent covers that disclosure. An existing connection does not automatically authorise additional health-data access or a new purpose.

Each external service’s processing is governed by its applicable terms and privacy notice, made available before connection. We explain whether it acts on our behalf or for its own purposes. MassOrBye remains responsible for its own processing and disclosures. Section 7.5 explains disconnection, withdrawal and deletion, and continued access to unrelated MassOrBye features.

MassOrBye offers optional connections with compatible wearable devices, connected fitness equipment and health or fitness platforms, including direct connections between a device and the application. Depending on the feature and permissions you choose, MassOrBye may receive, record, display or synchronise workout, physical activity and health data, including heart rate, to provide the training and tracking features you request. Where supported and authorised, relevant data may also be sent to a connected service.

Before activation, we explain the data involved, the purpose, the direction of exchange and any external service that will receive or process the data. Processing health data requires your prior explicit consent for the relevant purpose. A device connection or technical permission does not itself authorise public sharing, coach access or disclosure to an AI service. Those uses are subject to their own information and permissions.

You may manage permissions, withdraw consent and disconnect as explained in section 7.5. MassOrBye processes information it receives under this Policy. Where an external service is involved, its applicable privacy information is made available before connection. You may also request further information about supported integrations at contact@massorbye.com.

You may connect MassOrBye to a compatible health data service on your device. Depending on the permissions you grant, MassOrBye may read authorised health and physical activity records from that service or save MassOrBye workout records to it. The records may originate from your device or other applications connected to the service.

Before access, we explain the relevant data categories, purpose and direction of exchange. We process the information under this Policy, and health-data processing requires the applicable prior explicit consent.

If you connect MassOrBye to a supported fitness service, information is exchanged within the scope of that connection. Before activation, we identify the service and explain which records will be sent or received, the purpose and whether access includes existing or future workouts. Exchanging health data requires the applicable prior explicit consent. Each connected service processes received information under its own applicable terms, privacy notice and visibility settings.

Connections to external services are voluntary. You may manage data categories and sharing permissions through available controls in MassOrBye or the connected service. Disconnecting stops new data transfers through that connection, according to each service’s direction of exchange.

Disconnecting does not automatically delete data already incorporated into MassOrBye or received by the connected service. You may manage or request deletion of data held by MassOrBye under this Policy’s retention and rights sections. Data held by the other service are subject to its own controls, privacy policy and legal obligations. You may withdraw consent for a particular purpose without withdrawing other independent permissions. Withdrawing permission to disclose data to an integration stops that exchange; data already in MassOrBye may only continue to be processed for other purposes that remain validly authorised or have another legal basis and, for health data, a condition permitting processing.

If you withdraw consent for health-data processing, we stop that processing. Section 11 explains deletion and limited lawful retention of the affected data. Refusal or withdrawal does not prevent use of features that do not require that processing.

MassOrBye Coach enables coaches and coaching organisations to manage training relationships through the MassOrBye services. A coach may view public information like your public profile. Access through a coaching connection requires your acceptance. Before you accept, we identify the coach or organisation and explain the categories they can access, including the extent of existing workout history, future records and private training content covered by the connection.

Where that access includes health data, such as heart rate, injury information or health-related physical measurements, we obtain your prior explicit consent for the relevant disclosure. Connecting to a coach does not itself authorise unrelated account-data access, public disclosure or use of your health data for another purpose.

You may end the connection or withdraw the relevant permission to stop further access through MassOrBye. This does not automatically delete copies already lawfully received by the coach. We explain the parties’ respective responsibilities and how to exercise your rights before connection. Where MassOrBye processes information on a coach’s documented instructions, the applicable data processing agreement governs those operations; this does not change MassOrBye’s responsibilities for its own processing purposes.

8. Contacts and account discovery

Synchronising your address book helps you find people you know on MassOrBye. If you choose to use this feature, the contact details uploaded from your address book may include phone numbers and email addresses. We use the relevant identifiers to find accounts whose holders have allowed discovery through those identifiers and show connection suggestions. Synchronising your address book and allowing others to discover your own account are separate choices. Uploaded details may concern people without a MassOrBye account, who may also exercise the rights described in this Policy.

Contact Discovery helps friends find and connect with each other on MassOrBye. If you enable it, people who have your authorised contact details in their synchronised address book may find your profile and receive connection suggestions or notifications, including push and in-app notifications, indicating that you use MassOrBye. This can happen even if those people are not in your own address book or you have not synchronised your contacts.

Where onboarding offers Contact Discovery as a single choice covering both your phone number and email address, we explain that combined scope before you choose. You can manage each available identifier separately in your privacy settings, allowing discovery by phone number, email address, both or neither, according to the options available. We only use an identifier while it is covered by your permission: permission for phone discovery alone does not authorise email discovery. If an identifier is not yet available for discovery, we inform you and obtain any necessary additional permission before enabling it.

If you do not enable Contact Discovery, we will not show your account through this feature or generate related notifications. Verifying a phone number or email address, having a public profile, accepting the Terms and Conditions or synchronising your address book does not itself authorise discovery of your account.

You may disable Contact Discovery using the available MassOrBye control or by contacting contact@massorbye.com, so your account no longer appears in this feature’s matches and new notifications about it stop. You may also request complete deletion of synchronised contacts and associated address book data without deleting your account. Deleting your address book and disabling discovery are independent choices: deleting contacts you uploaded does not itself withdraw permission for others to find you through their own address books. Disabling Contact Discovery removes persistent matches and suggestions from this feature and cancels pending notifications that have not yet been delivered.

Withdrawal does not reverse notifications already delivered. You may exercise your rights regarding data MassOrBye retains about these features. If you synchronise your address book again after deleting it, contact data will be uploaded again under the applicable information and permission.

Revoking contact access in your device settings prevents new address book access but does not automatically delete contacts already sent to MassOrBye or itself withdraw permission for others to discover your account.

When another user synchronises their address book, we may receive your phone number and email address, even if you do not have a MassOrBye account. This contact information is provided by the user synchronising their address book. We use the relevant identifiers to find accounts whose holders have allowed discovery through those identifiers. Receiving your contact details does not create an account in your name or authorise us to show you as a MassOrBye user.

This processing relies on the legitimate interest explained in the legal bases section. Recipients, transfer safeguards and retention criteria are explained in their respective sections. You may contact contact@massorbye.com to ask whether we process your data and exercise applicable rights, including objection and deletion, without registering with MassOrBye.

We provide information about this processing within the conditions and deadlines in Article 14 GDPR. Where a legal exception to individual notification applies, we take the required measures to protect your rights and keep this information accessible.

9. Visibility and communications

When you create an account, your profile is public by default. Workouts set to “Everyone” are visible to all MassOrBye users. You may set your profile to private and manage workout visibility in the application’s settings menu.

Available controls include:

  • Workout visibility: you may choose which workouts other users can see and whether heart rate and calories are displayed publicly, both per workout and through general settings. You may change these choices. These controls are independent of profile visibility and integration permissions. Publishing health data, such as heart rate, requires your explicit consent for that purpose. A public profile or visible workout does not itself replace that permission. You may withdraw permission to publish these data without deleting your account or withdrawing consents for other independent purposes.
  • Integration management: you may manage connections and shared data through the controls in MassOrBye or the connected service. Section 7.5 explains disconnection and deletion. Profile visibility settings do not replace integration permissions.
  • Communication preferences: you may subscribe to or unsubscribe from marketing communications at any time. You may manage push notifications in your device settings and email preferences in your account settings. Disabling push notifications on your device affects notifications you receive; it does not withdraw discovery permission or itself prevent others from receiving notifications about your account.

When you manually tag a gym in a workout, the tag links that workout to the place you select. Your profile may be suggested to other people who train at that gym. Where gym profiles are available, eligible public workouts may appear in the gym’s feed and contribute to associated leaderboards, within the audience explained before you enable that visibility. This requires your profile and the workout to be public and the gym-visibility setting to allow it. Private profiles and private workouts are excluded. The gym feed displays the workout date rather than its exact time. Before including previously tagged workouts in a newly introduced gym audience, we explain that use and obtain the choice required for the new visibility.

You may hide a workout from gym profiles without deleting the workout or its gym tag. You may also remove the gym tag, make the workout private or make your profile private. These choices stop the corresponding display and identifiable participation derived from that workout in the gym feature. Health data is published only within the scope of the separate explicit permission described above.

Changing content visibility restricts access through MassOrBye according to your settings but does not itself delete account data or recover all copies previously obtained by other people or services. This does not limit your deletion or consent withdrawal rights or MassOrBye’s obligations regarding data it controls. Section 13 explains those rights and our obligations to notify recipients and take reasonable measures regarding published content.

10. Geolocation

When you choose to tag an existing gym in MassOrBye, you may allow access to your device’s location to sort the list of nearby gyms and help you select the right one. We use this location to sort the list each time you request this feature.

Selecting a gym tag is separate from allowing access to your device’s location. The tag records the place you choose; its visibility on a workout or gym profile is governed by section 9.

To suggest users in your area and manage the availability of contact synchronisation in certain countries, we use an approximate location estimate derived from your public IP address when you create your account. This estimate may include country, city and approximate coordinates, and is stored as a single record with its date and time. The estimate may be inaccurate and does not involve GPS or continuous tracking of your movements. This processing relies on the legitimate interests explained in section 3.3. You may object by contacting contact@massorbye.com. Retention is explained in section 11.

11. Data retention

MassOrBye STUDIOS retains personal data for the following periods:

Account and profile data: while the account remains open, even if you stop using the application, subject to your deletion rights.

Physical activity and workout data, including recorded heart rate: while the account remains open and data is necessary for validly authorised purposes, or until you request deletion or withdraw the consent supporting processing, subject to limited retention legally permitted.

Strength Levels: source records linked or reasonably linkable to an account follow the workout, consent and deletion rules above. Truly anonymous benchmarks may remain once a contribution can no longer reasonably be identified or separated. Removing a name or account identifier alone does not establish anonymity, particularly where information could be matched with workout histories, public profiles or small groups.

Coaching connections: ending the connection stops further access. Records in your MassOrBye account follow their applicable purposes, permissions and retention rules. Copies already held by the coach are subject to the arrangements, privacy information and deletion rights explained in section 7.6.

Optional body data (height, weight and measurements): while the account remains open or until you request deletion. They are deleted within thirty (30) days of your request or account deletion, subject to any legally required blocking.

Approximate location obtained at account creation: we retain the record while your account remains open to provide connection suggestions during use and delete it when the account is deleted, subject to your objection, rectification and deletion rights.

Synchronised contacts: we retain address book data for the requested matching feature only while necessary and supported by a legal basis. The maximum period is the life of the account uploading them; data is deleted earlier where deletion or withdrawal of the relevant permission requires it. You may request complete deletion without closing your account at contact@massorbye.com. Retention does not continue merely because an account remains open when data is no longer necessary.

AI-assisted support: tickets, attachments, response suggestions and associated data are retained to handle and close the enquiry. Subsequent retention is limited to information necessary for complaints or establishing liability, subject to applicable restrictions and legal blocking. Health data may only be retained while there is an authorised purpose or an independent legal condition, such as information strictly necessary to establish, exercise or defend legal claims (Article 9(2)(f) GDPR). Legitimate interest alone does not permit retention of health data after consent withdrawal. Moderation records are retained to resolve incidents and handle associated challenges and liability.

Purchases and subscriptions: transaction and subscription status data, including limited payment data received, are retained to manage contracted access and associated transactions or complaints. Once these needs end, only information required by law or necessary for liability is retained, subject to the applicable restrictions.

Usage analytics and campaign measurement: identifiable events are retained only for the period necessary to produce and verify the statistics or attribution results for the relevant measurement period. Retention is not automatically extended because your account remains open. Where withdrawal removes the basis for continued processing, we delete or irreversibly anonymise the affected identifiable records without undue delay, subject to the deletion period and limited legal-retention exceptions below. Other requests to delete previously collected data are handled under section 13. Consent records may be retained as necessary to demonstrate compliance, separately from continued analytics. Applicable device-storage lifetimes are explained in the relevant technology information.

Messaging and verification records: providers used for phone verification by SMS may retain numbers and request data for at least thirty days; this is a service minimum, not a guarantee of automatic deletion. Further retention may result from legal obligations or justified security and abuse prevention needs. Code expiry does not mean these records are deleted.

Recruitment data: with the applicant’s consent, MassOrBye STUDIOS may retain data for up to two years following the selection process.

Partner programme information: we retain the membership identifier and associated contact information while necessary to verify and administer your programme access. A minimum membership-to-account mapping may also be needed to restore access or link a replacement MassOrBye account to the same valid subscription. We retain an email address for this purpose only where it is necessary. When the subscription and any necessary reconciliation end, we delete the mapping and contact information unless limited retention is independently justified for legal obligations or claims. Closing a MassOrBye account does not justify indefinite retention of the full mapping; any remaining retention must be necessary for the specific continuing purpose. Usage-event messages sent to the membership partner are processed for transmission, and MassOrBye does not retain a separate copy afterwards. This is distinct from membership and billing records retained under the criteria above. The partner’s retention of information it receives is governed by its applicable privacy information.

For cookies and related technologies used on our website, their lifetimes and applicable retention periods are explained in this Privacy Policy: https://massorbye.com/privacy.html. Information and choices concerning technologies used in the app are provided for those technologies; the website policy does not itself cover app SDKs.

Location used to sort nearby gyms is processed when you request this feature. A gym tagged on your profile is retained until you remove it or delete your account. A gym tagged on a workout is retained until you remove it from that workout, delete the workout or delete your account, subject to applicable legal retention obligations.

Consent withdrawal stops processing based on that consent without affecting the lawfulness of previous processing. Data is deleted without undue delay and, under MassOrBye STUDIOS’ stated period, within 30 days, except information necessary for legal obligations or establishing, exercising or defending claims. Any lawful retention is restricted or blocked as applicable until the relevant period expires, and the data is then deleted. Retaining health data additionally requires a condition under Article 9 GDPR. The 30-day period does not authorise continued consent-based processing. Any backups temporarily retained remain protected and are not used for purposes for which permission has been withdrawn.

12. Confidentiality and security

MassOrBye STUDIOS uses personal data confidentially and maintains appropriate technical and organisational security measures in its facilities and systems, covering the collection and use of information provided over the internet. These measures take account of current technology, the nature of stored data and the risks to protect against accidental loss and unauthorised access, processing or disclosure.

Information is disclosed only for the purposes described in this Policy, with the applicable legal basis and safeguards.

MassOrBye STUDIOS provides appropriate technical means for you to access the privacy notice or other relevant information before submitting personal data and, where applicable, to consent to processing.

13. Data protection rights

Where applicable, you may exercise access, rectification, deletion, portability, restriction and objection rights at contact@massorbye.com, optionally using “Data Protection Rights” as a reference. You may also withdraw consent through that channel or the controls enabled for each purpose, as easily as it was given. We generally respond within one month; if an extension of up to two additional months is justified by complexity or the number of requests, we inform you within the first month. Additional identity information is requested only where reasonable doubts exist and to the extent necessary.

You can disable optional usage analytics and manage the available campaign-measurement choices through the in-app privacy controls without deleting your account. Health-data permissions, connected services, coaches and gym visibility have their respective controls. Withdrawing one permission does not withdraw other independent permissions.

Access: you may request and obtain information about personal data we process about you, including website, application and integration data, the processing carried out and its purposes and specific uses.

Rectification: you may have inaccurate or incomplete personal data corrected.

Deletion: you may request deletion where data is no longer necessary, consent is withdrawn and no other legal justification permits retention, your objection succeeds or processing is unlawful, among other circumstances provided by law. You may exercise this right for specific data or purposes without deleting your entire account, subject to legally necessary retention.

Objection: you may object on grounds relating to your particular situation to processing based on legitimate interests under Article 21 GDPR. We stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is needed to establish, exercise or defend legal claims. You may object to direct marketing processing at any time.

Restriction: you may request that personal data held by the controller or processors be marked to restrict future processing.

Portability: you may receive personal data you provided in a structured, commonly used, machine-readable format and transmit them to another controller where processing is based on consent or a contract and carried out by automated means.

Automated individual decisions: you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you.

Where applicable, we notify recipients of rectification, deletion or restriction unless impossible or disproportionate under the law. You may request information about those recipients. Where we have made data public and must delete them, we take legally required reasonable steps to inform other controllers processing links, copies or replications.

You may also file a complaint to the Spanish Data Protection Agency (https://www.aepd.es) or the competent supervisory authority, particularly in your place of habitual residence or work, if you consider that processing infringes the law.

14. Changes to this Policy

If we change how we process personal data, we update this Policy and indicate the updated version’s date. We notify you of significant changes by email or another appropriate channel and, before starting processing that requires it, provide information and obtain the relevant consent. Notification of an update or continued use of MassOrBye does not replace that consent. Adding a compatible device or service does not automatically authorise new purposes, data categories or recipients. Where a change affects the scope of a connection or sharing choice, we explain it before the new processing and obtain any additional permission required.

15. Further information

We will be pleased to provide further information about how we protect and use your personal information. Please contact contact@massorbye.com.

© 2026 MassOrBye. All rights reserved.